Don't override error responses from other handlers

We should never touch responses that other handlers have already set.

See WP-API/Basic-Auth#5, WP-API/Basic-Auth#8, WP-API/WP-API#340